diff --git a/server/src/application/getGame.go b/server/src/application/getGame.go
index ab717fc..6157cff 100644
--- a/server/src/application/getGame.go
+++ b/server/src/application/getGame.go
@@ -6,6 +6,9 @@ import (
 )
 
 func (app Application) GetGameById(id string) (*game.Game, error) {
+	app.mu.Lock()
+	defer app.mu.Unlock()
+
 	gm := app.games[id]
 	if gm == nil {
 		return nil, fmt.Errorf("unknown id")
diff --git a/server/src/application/getUser.go b/server/src/application/getUser.go
index 0816e24..736051b 100644
--- a/server/src/application/getUser.go
+++ b/server/src/application/getUser.go
@@ -6,6 +6,9 @@ import (
 )
 
 func (app Application) GetUserById(id string) (*user.User, error) {
+	app.mu.Lock()
+	defer app.mu.Unlock()
+
 	usr := app.users[id]
 	if usr == nil {
 		return nil, fmt.Errorf("unknown id")
@@ -14,6 +17,9 @@ func (app Application) GetUserById(id string) (*user.User, error) {
 }
 
 func (app Application) GetUserByAuthcode(authcode string) (*user.User, error) {
+	app.mu.Lock()
+	defer app.mu.Unlock()
+
 	for _, usr := range app.users {
 		if usr.GetAuthCode() == authcode {
 			return usr, nil
diff --git a/server/src/application/loadGames.go b/server/src/application/loadGames.go
index 2d00e00..56a8b3a 100644
--- a/server/src/application/loadGames.go
+++ b/server/src/application/loadGames.go
@@ -12,6 +12,10 @@ func (app Application) loadGames() error {
 	if err != nil {
 		return err
 	}
+
+	app.mu.Lock()
+	defer app.mu.Unlock()
+
 	for _, file := range files {
 		id := file.Name()
 		fileName := path.Join(dirName, id, "game.json")
diff --git a/server/src/application/loadUsers.go b/server/src/application/loadUsers.go
index 98a56ef..5b84a3d 100644
--- a/server/src/application/loadUsers.go
+++ b/server/src/application/loadUsers.go
@@ -12,6 +12,10 @@ func (app Application) loadUsers() error {
 	if err != nil {
 		return err
 	}
+
+	app.mu.Lock()
+	defer app.mu.Unlock()
+
 	for _, file := range files {
 		fileName := path.Join(dirName, file.Name())
 		if usr, err := user.NewUserFromFile(fileName); err != nil {
diff --git a/server/src/application/struct.go b/server/src/application/struct.go
index 913ec20..57804c8 100644
--- a/server/src/application/struct.go
+++ b/server/src/application/struct.go
@@ -4,9 +4,11 @@ import (
 	"sirlab.de/go/knyt/applicationConfig"
 	"sirlab.de/go/knyt/game"
 	"sirlab.de/go/knyt/user"
+	"sync"
 )
 
 type Application struct {
+	mu     sync.Mutex
 	config applicationConfig.ApplicationConfig
 	users  map[string]*user.User
 	games  map[string]*game.Game
diff --git a/server/src/engine/engine.go b/server/src/engine/engine.go
index 9c4b966..c30e9ab 100644
--- a/server/src/engine/engine.go
+++ b/server/src/engine/engine.go
@@ -25,11 +25,19 @@ func (eng *Engine) Run() {
 			time.Sleep(1 * time.Second)
 		}
 
-		eng.versionRef++
-		fmt.Printf("game %s: %d\n", eng.id, eng.versionRef)
-		data := syncdata.SyncData{
-			VersionRef: eng.versionRef,
-		}
-		eng.obs.Update(data)
+		eng.doSomething()
 	}
 }
+
+func (eng *Engine) doSomething() {
+	eng.mu.Lock()
+	defer eng.mu.Unlock()
+
+	eng.versionRef++
+	fmt.Printf("game %s: %d\n", eng.id, eng.versionRef)
+	data := syncdata.SyncData{
+		VersionRef: eng.versionRef,
+	}
+
+	eng.obs.Update(data)
+}
diff --git a/server/src/engine/struct.go b/server/src/engine/struct.go
index 9407e79..9dcf40b 100644
--- a/server/src/engine/struct.go
+++ b/server/src/engine/struct.go
@@ -3,11 +3,13 @@ package engine
 import (
 	"github.com/imkira/go-observer"
 	"net/http"
+	"sync"
 )
 
 type HandleFunc func(http.ResponseWriter, *http.Request)
 
 type Engine struct {
+	mu         sync.Mutex
 	id         string
 	versionRef int
 	obs        observer.Property
diff --git a/server/src/engine/sync.go b/server/src/engine/sync.go
index bfa3919..7775132 100644
--- a/server/src/engine/sync.go
+++ b/server/src/engine/sync.go
@@ -14,7 +14,10 @@ func (eng *Engine) SyncHandler(w http.ResponseWriter, r *http.Request) {
 		versionRef = -1
 	}
 
+	eng.mu.Lock()
 	stream := eng.obs.Observe()
+	eng.mu.Unlock()
+
 	var value syncdata.SyncData
 	for {
 		value = stream.Value().(syncdata.SyncData)
diff --git a/server/src/game/game.go b/server/src/game/game.go
index 5d04a5f..f6e6b48 100644
--- a/server/src/game/game.go
+++ b/server/src/game/game.go
@@ -41,10 +41,16 @@ func (gm *Game) GetEngine() *engine.Engine {
 }
 
 func (gm *Game) UpdatePlayerTimestamp(usr *user.User) {
+	gm.mu.Lock()
+	defer gm.mu.Unlock()
+
 	gm.playerTimestamp[usr.GetId()] = time.Now()
 }
 
 func (gm *Game) GetActivePlayers() []string {
+	gm.mu.Lock()
+	defer gm.mu.Unlock()
+
 	players := make([]string, 0)
 
 	now := time.Now()
diff --git a/server/src/game/struct.go b/server/src/game/struct.go
index 98ea503..c10b15e 100644
--- a/server/src/game/struct.go
+++ b/server/src/game/struct.go
@@ -2,10 +2,12 @@ package game
 
 import (
 	"sirlab.de/go/knyt/engine"
+	"sync"
 	"time"
 )
 
 type Game struct {
+	mu              sync.Mutex
 	id              string
 	name            string
 	eng             *engine.Engine
diff --git a/server/src/user/struct.go b/server/src/user/struct.go
index bc73c3a..5ef1079 100644
--- a/server/src/user/struct.go
+++ b/server/src/user/struct.go
@@ -1,5 +1,9 @@
 package user
 
+import (
+	"sync"
+)
+
 const (
 	ROLE_ADMIN      = "admin"
 	ROLE_GAMEMASTER = "gamemaster"
@@ -7,6 +11,7 @@ const (
 )
 
 type User struct {
+	mu       sync.Mutex
 	id       string
 	authcode string
 	name     string
diff --git a/server/src/user/user.go b/server/src/user/user.go
index e499e52..5244a31 100644
--- a/server/src/user/user.go
+++ b/server/src/user/user.go
@@ -31,34 +31,55 @@ func NewUserFromFile(fileName string) (*User, error) {
 	}
 }
 
-func (user *User) GetId() string {
-	return user.id
+func (usr *User) GetId() string {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	return usr.id
 }
 
-func (user *User) GetAuthCode() string {
-	return user.authcode
+func (usr *User) GetAuthCode() string {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	return usr.authcode
 }
 
-func (user *User) GetName() string {
-	return user.name
+func (usr *User) GetName() string {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	return usr.name
 }
 
-func (user *User) GetRole() string {
-	return user.role
+func (usr *User) GetRole() string {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	return usr.role
 }
 
-func (user *User) GetGameId() string {
-	return user.gameId
+func (usr *User) GetGameId() string {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	return usr.gameId
 }
 
-func (user *User) IsPlayer() bool {
+func (usr *User) IsPlayer() bool {
 	return true
 }
 
-func (user *User) IsGamemaster() bool {
-	return user.role == ROLE_GAMEMASTER || user.role == ROLE_ADMIN
+func (usr *User) IsGamemaster() bool {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	return usr.role == ROLE_GAMEMASTER || usr.role == ROLE_ADMIN
 }
 
-func (user *User) IsAdmin() bool {
-	return user.role == ROLE_ADMIN
+func (usr *User) IsAdmin() bool {
+	usr.mu.Lock()
+	defer usr.mu.Unlock()
+
+	return usr.role == ROLE_ADMIN
 }